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What Is Claimed Is: 


1 1. A fault tolerant processing circuit 

2 comprising: 

3 at least three processor groupings each of 

4 said at least three processor groupings having a 

5 plurality of processor grouping inputs and a 

6 plurality of processor grouping outputs; 

7 a processor system clock coupled to the 

8 fault tolerant processing circuit; 

9 a synchronizing circuit comprising a 

10 plurality of output synchronizers, each output 

11 synchronizer in operative communication with a 

12 corresponding respective processor grouping for 

13 synchronizing the output of each processor grouping; 

14 a logic circuit in operative communication 

15 with said synchronizing circuit, said logic circuit 

16 comprising a fault detection circuit and a fault mask 

17 circuit, said logic circuit adapted to compare said 

18 plurality of processor group outputs to detect errors 

19 in any one of said plurality of processor group 
2 0 outputs; and 

21 a control logic circuit for resetting each 

22 of said at least three processor groups when none of 

23 said at least three processor groups is in a majority 

24 of said processor groups, wherein said fault mask 

25 circuit is adapted to mask the output of a respective 

26 processor grouping associated with a detected error 

27 and signal a detected error. 
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1 2 . A fault tolerant processing system 

2 according to claim 1 wherein said synchronizing 

3 circuit further comprises continuously active 

4 synchronization signals. 

1 3 . A fault tolerant processing system 

2 according to claim 1 wherein said synchronizing 

3 circuit further comprises periodically active 

4 synchronization signals. 

1 4. A fault tolerant processing system 

2 according to claim 1 wherein said synchronizing 

3 circuit further comprises asynchronous signals. 

1 5. A fault tolerant processing system 

2 according to claim 1 wherein said synchronizing 

3 circuit further comprises logic operative to 

4 synchronize a JTAG TCLK with said processor system 

5 clock. 

1 6. A fault tolerant processing system 

2 according to claim 1 wherein an expected rate of 

3 transient faults is tuned by a latent fault scrubbing 

4 rate. 

1 7. A fault tolerant processing system 

2 according to claim 1 wherein each of said at least 

3 three processor groupings comprises: 

4 a central processing unit (CPU) , having an 

5 operating step executed during a clock cycle and 

6 operating synchronously with each other CPU, each 
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7 operating step of each CPU being accomplished in 

8 parallel and substantially simultaneously with each 

9 of the other at least three CPUs each clock cycle, 

10 each of said at least three CPUs having a plurality 

11 of CPU inputs and a plurality of CPU outputs; and 

12 a respective support logic device coupled 

13 to said plurality of CPU inputs and said plurality of 

14 CPU outputs and having a plurality of support logic 

15 device inputs and outputs coupled to said respective 

16 CPU. 

1 8. A fault tolerant processing system 

2 according to claim 1, wherein said logic circuit 

3 resets each of said at least three processor groups 

4 upon detected a fault and, in response, each of said 

5 at least three processor groups restart at a hardware 

6 defined operating step. 

1 9. A fault tolerant processing system 

2 according to claim 8, wherein said logic circuit 

3 interrupts said at least three processor groups when 

4 one of said processor groups has a fault, whereby 

5 each of said at least three processor groups without 

6 detected faults store state information and said 

7 logic circuit resets each of said at least three 

8 processor groups after said state information is 

9 stored to restart said at least three processor 
10 groups at a state defined operating step. 

1 10. A fault tolerant processing system 

2 according to claim 8, wherein said logic circuit 
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3 interrupts said at least three processor groups when 

4 a minority of said processor groups has a fault, and 

5 wherein each of said at least three processor groups 

6 without an error stores state information and said 

7 logic circuit resets each of said at least three 

8 processor groups after said state information is 

9 stored to restart said at least three processor 
10 groups at a state defined operating step. 

1 11. A fault tolerant processing system 

2 according to claim 9, wherein said logic circuit 

3 includes fault control and status registers for 

4 storing said state information. 

1 12 . A fault tolerant processing system 

2 according to claim 1, wherein each of said at least 

3 three support logic devices includes a memory system. 

1 13. A satellite system comprising: 

2 a ground station; 

3 a satellite in operative communication with said 

4 ground station, said satellite including a fault 

5 tolerant processing circuit comprising: 

6 at least three processor groupings each of 

7 said at least three processor groupings having a 

8 plurality of processor grouping inputs and a 

9 plurality of processor grouping outputs; 

10 a synchronizing circuit comprising a 

11 plurality of output synchronizers, each output 

12 synchronizer in operative communication with a 
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13 corresponding respective processor grouping for 

14 synchronizing the output of each processor grouping; 

15 a fault logic circuit in operative 

16 communication with said synchronizing circuit, said 

17 fault logic circuit comprising a fault detection 

18 circuit and a fault mask circuit, said fault logic 

19 circuit adapted to compare said plurality of 
2 0 processor group outputs to detect errors in any one 

21 of said plurality of processor group outputs; 

22 a control logic circuit for resetting each 

23 of said at least three processor groups when none of 

24 said at least three processor groups is in a majority 

25 of said processor groups, wherein said fault mask 

26 circuit is adapted to mask the output of a respective 

27 processor grouping associated with a detected error 
2 8 and signal a detected error; and 

29 a system bus coupled to each of said 

30 plurality of processor group inputs and said fault 

31 logic circuit output. 

1 14 . A fault tolerant processing system 

2 according to claim 13 wherein said synchronizing 

3 circuit further comprises continuously active 

4 synchronization signals. 


1 15. A fault tolerant processing system 

2 according to claim 13 wherein said synchronizing 

3 circuit further comprises periodically active 

4 synchronization signals. 
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1 16. A fault tolerant processing system 

2 according to claim 13 wherein said synchronizing 

3 circuit further comprises asynchronous signals. 

1 17. A fault tolerant processing system 

2 according to claim 13 wherein said synchronizing 

3 circuit further comprises logic operative to 

4 synchronize a JTAG TCLK with said processor system 

5 clock. 

1 18. A fault tolerant processing system 

2 according to claim 13 wherein an expected rate of 

3 transient faults is tuned by said latent fault 

4 scrubbing rate. 

1 19. A satellite system according to claim 

2 13 wherein each of said at least three processor 

3 groupings comprises: 

4 a central processing unit, having an 

5 operating step executed during a clock cycle and 

6 operating synchronously with each other CPU, each 

7 operating step of each CPU being accomplished in 

8 parallel and substantially simultaneously with each 

9 of the other at least three CPUs each clock cycle, 

10 each of said at least three CPUs having a plurality 

11 of CPU inputs and a plurality of CPU outputs; and 

12 a respective support logic device coupled 

13 to said plurality of CPU inputs and said plurality of 

14 CPU outputs and having a plurality of support logic 

15 device inputs and outputs coupled to said respective 

16 CPU. 
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1 20. A satellite system according to claim 

2 13, wherein said fault logic circuit resets each of 

3 said at least three processor groups upon detected a 

4 fault and, in response, each of said at least three 

5 processor groups restart at a hardware defined 

6 operating step. 

1 21. A satellite system according to claim 

2 15, wherein said fault logic circuit interrupts said 

3 at least three processor groups when one of said 

4 processor groups has a fault, whereby each of said at 

5 least three processor groups without detected faults 

6 store state information and said fault logic circuit 

7 resets each of said at least three processor groups 

8 after said state information is stored to restart 

9 said at least three processor groups at a state 
10 defined operating step. 

1 22. A satellite system according to claim 

2 15, wherein said fault logic circuit interrupts said 

3 at least three processor groups when a minority of 

4 said processor groups has a fault, and wherein each 

5 of said at least three processor groups without an 

6 error stores state information and said fault logic 

7 circuit resets each of said at least three processor 

8 groups after said state information is stored to 

9 restart said at least three processor groups at a 
10 state defined operating step. 
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1 23. A satellite system according to claim 

2 21, wherein said fault logic circuit includes fault 

3 control and status registers for storing said state 

4 information. 

1 24. A satellite system according to claim 

2 13, wherein each of said at least three support logic 

3 devices includes a memory system. 

1 25. A method of masking the effect of a 

2 single event upset in a fault tolerant processing 

3 system including at least three processor groups, 

4 each processor group including a CPU, an input, an 

5 output, and a support logic device, said method 

6 comprising the steps of: 

7 monitoring each of said plurality of 

8 processor group outputs; 

9 detecting an error in one of said processor 

10 group outputs by comparing the outputs of each of 

11 said at three processor groups against each other; 

12 classifying each processor group as a 

13 majority processor group or minority processor group, 

14 said majority processor groups all having equal value 

15 outputs and comprising a majority of all processor 

16 groups, said minority processing groups each having 

17 an output different than each majority processing 

1 8 group ; 

19 when any processor group is classified as a 
2 0 minority processor group, storing state information 

21 for at least one of said processor groups classified 

22 as a majority processor group; 
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23 simultaneously resetting each of said 

24 processor groups to restart at a state defined 
2 5 operating step; and 

26 restoring said stored state information to 

27 each of said processor groups. 

1 2 6. A method according to claim 25 

2 wherein, when no processor group is classified as a 

3 majority processor group, simultaneously resetting 

4 each of said processor groups and initializing each 

5 of said processor groups to restart at a state 

6 defined operating step. 


